Build the livery listener map for barrel_server (H1/H2/H3, TLS, mTLS) from the app env.

With no listeners key the server behaves exactly as before: a single cleartext HTTP/1.1 listener on http_port. A listeners map opts into multi-protocol serving:

     {barrel_server, listeners, #{http  => #{port => 8080},
                                  https => #{port => 8443},
                                  http3 => #{port => 8443}}}

https (H2) and http3 (H3) require TLS, from a shared config:

     {barrel_server, tls, #{certfile, keyfile, cacertfile, verify}}

The http (H1) listener stays cleartext unless its entry sets tls => true (used for the sync-wire mTLS gate, since the replication client speaks HTTP/1.1). mTLS is requested with verify => verify_peer + cacertfile; because livery/h1/h2 drop a top-level verify, the real knobs are packed into ssl_opts. H3 is TLS-serving only; its client-cert gate is not yet complete (see the companion livery change).